fix(viewer): externalize repos page inline script to comply with CSP

internal/viewer/server.go

@@ -14,7 +14,7 @@ import (
 	"time"
 )
 
-//go:embed templates/*.html static/style.css static/session.js
+//go:embed templates/*.html static/style.css static/session.js static/repos.js
 var assets embed.FS
 
 func StartServer(addr string) error {

internal/viewer/server_extra_test.go

@@ -84,10 +84,7 @@ func TestRenderTemplate_WithRepos(t *testing.T) {
 		`id="repository-search-input"`,
 		`id="repositories-table"`,
 		"data-repository-name",
-		`addEventListener("input"`,
-		"toLowerCase()",
-		"name.includes(query)",
-		"row.hidden",
+		`src="/static/repos.js"`,
 	} {
 		if !strings.Contains(body, required) {
 			t.Errorf("rendered repository page missing %q", required)

internal/viewer/static/repos.js

@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 alibaba/open-code-review Contributors
+
+(() => {
+    const input = document.getElementById("repository-search-input");
+    const table = document.getElementById("repositories-table");
+    if (!input || !table) return;
+
+    const rows = table.querySelectorAll("tbody tr");
+    input.addEventListener("input", () => {
+        const query = input.value.trim().toLowerCase();
+        rows.forEach((row) => {
+            const nameCell = row.querySelector("[data-repository-name]");
+            const name = nameCell ? nameCell.textContent.trim().toLowerCase() : "";
+            row.hidden = !name.includes(query);
+        });
+    });
+})();

internal/viewer/templates/repos.html

@@ -28,23 +28,7 @@ <h2>Repositories</h2>
     {{end}}
     </tbody>
 </table>
-<script>
-(() => {
-    const input = document.getElementById("repository-search-input");
-    const table = document.getElementById("repositories-table");
-    if (!input || !table) return;
-
-    const rows = table.querySelectorAll("tbody tr");
-    input.addEventListener("input", () => {
-        const query = input.value.trim().toLowerCase();
-        rows.forEach((row) => {
-            const nameCell = row.querySelector("[data-repository-name]");
-            const name = nameCell ? nameCell.textContent.trim().toLowerCase() : "";
-            row.hidden = !name.includes(query);
-        });
-    });
-})();
-</script>
+<script src="/static/repos.js"></script>
 {{else}}
 <p>No session data found. Run a code review first.</p>
 {{end}}